Tavis Ormandy of the Gentoo Linux Security Audit Team has reported that
xli and xloadimage contain a flaw in the handling of compressed images,
where shell meta-characters are not adequately escaped. Rob Holland of
the Gentoo Linux Security Audit Team has reported that an xloadimage
vulnerability in the handling of Faces Project images discovered by
zen-parse in 2001 remained unpatched in xli. Additionally, it has been
reported that insufficient validation of image properties in xli could
potentially result in buffer management errors.

Impact
======

Successful exploitation would permit a remote attacker to execute
arbitrary shell commands, or arbitrary code with the privileges of the
xloadimage or xli user.

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug athttp://bugs.gentoo.org.